A smart contract is a special type of transaction designed for the execution of automated logic on blockchains. Alas, smart contracts transactions are one of the major hindrances to blockchain throughput. Hence, improving the execution time of smart contracts is a prime challenge for Blockchains at large. To that end, concurrent execution of smart contract is an appealing direction, which has been adopted by several contemporary Blockchains like Solana, Aptos, Sui, Sei, and Monad. Executing smart contracts in parallel requires applying deterministic concurrency controls based on ensuring consistent ordering of all conflicting transactions in all miners/validators. Existing implementations rely on the Block's total ordering to resolve this requirement. Recently, it has been suggested that relying on minimal coloring of the conflict graph corresponding to the Block's transactions can provide a better performance potential, yet without any evaluation. In this paper, we compare between approaches to smart contracts parallelization. Our study’ finds that in many situations, indeed the coloring-based ordering leads to significantly better performance than the Block order preserving approach. However, this gain has its limits, and it is not always guaranteed. In particular, the results are largely dependent on the conflict ratio in the conflict graph and the type of application.
Unmanned Aerial Vehicles (UAVs) rely on wireless communication with a Ground Control Station (GCS) for flight control, primarily using the Micro Air Vehicle Link (MAVLink) protocol. However, MAVLink lacks essential security mecha-nisms, making UAVs vulnerable to attacks. We introduce a stealthy relay-based Man-in-the-Middle (MITM) attack called Shadow-GCS, in which an unauthorized node relays MAVLink messages to maintain normal communication while injecting commands. The Shadow-GCS attack enables an adversary to monitor and control UAV s without triggering alerts at the GCS. To assess the attack's detectability, we collected a dataset from four realistic UAV-GCS scenarios. We then evaluated two existing MAVLink intrusion detection systems (IDSs), revealing their limitations in identifying attacks that do not significantly alter normal communication flow. To overcome these limitations and develop a more generalized intrusion detection capability, we propose GALAXY, an attention-based LSTM model with a single LSTM layer, where the attention weights are jointly derived from the hidden state and local statistical features. Experimental results show that GALAXY achieves detection performance comparable to a stacked LSTM baseline while offering improved interpretability.
The automotive industry increasingly relies on Over-the-Air (OTA) updates to deliver essential security patches to vehicles. However, this dependence may introduce significant cy-bersecurity vulnerabilities, particularly concerning the integrity and privacy of updates. This paper presents an integrated framework that combines threat modeling and formal verification by employing an identical system model across all stages. The process begins with applying the ThreatGet tool to identify potential threats in the OTA update process, which directly guide the formulation of formal security requirements expressed as Computation Tree Logic (CTL) properties. The same high-level model encompassing a Cloud Server (CS), Telematics Control Unit (TCU), Central Gateway Unit (CGU), Advanced Driver Assistance System (ADAS) module, and an attacker module is consistently used for both threat modeling and encoding in the NuSMV model checker. This unified approach ensures that identified threats translate seamlessly into verifiable properties. Experimental threat analysis and verification results demonstrate the effectiveness of our integrated approach in uncovering OTA update vulnerabilities properties.
AI-based code generation tools significantly enhance development productivity, but the code modifications proposed by generative AI are not always safe or consistent with the intended objectives. Even if AI-based code generation tools perform code modifications based on prompts or user-defined goals, the entity that holds the actual responsibility for the impact of the generated code on users is not the code generation tool itself, but the developer who provides the prompts and goals. Based on this situation, this study considered that the important issue for improving the functionality of dependency assurance in AI-based code generation tools is how to implement human approval and intervention. In this study, we analyzed the traits (features) of AI-generated code, presented them as vectorized values, and designed and implemented an interface that allows developers to make intuitive decisions by visualizing them. When using this tool, developers can utilize additional visualized information during the process of reviewing code changes, allowing them to consider the impact of their decisions while using AI-based code generation tools. The main contribution of this study lies in the conceptual design and implementation of providing visualized importance information of generated code changes to improve the user experience of utilizing code generation tools.
Large Language Models (LLMs) have rapidly advanced in reasoning capability and accessibility, driving their deployment across diverse applications. Yet this progress has also widened the surface for safety and security vulnerabilities. Adversaries can exploit prompt diversity, dialog memory, or multimodal inputs to induce unsafe or confidential outputs, while continual fine-tuning and third-party integration render static assurance infeasible. This paper introduces our ongoing national R&D project on developing the AutoPT Framework-an Autonomous Purple Teaming architecture that extends the collaborative principles of purple teaming toward self-adaptive, continuously verifiable LLM assurance. AutoPT unifies autonomous adversarial exploration and adaptive defensive reinforcement through two co-evolving agents. The red module, AutoPT-Red, employs coverage-guided fuzzing and internal measurement metrics to autonomously uncover vulnerabilities. The blue module, AutoPT-Blue, performs self-healing adaptation by updating guardrails and detecting integrity or confidentiality violations using embedding-based feedback. Preliminary case studies on jailbreak fuzzing and backdoor-poisoning defense validate the feasibility of this closed-loop, self-adapting architecture. As part of a broader national initiative, this work lays the conceptual and technical foundation for transitioning industrial purple teaming into a fully autonomous, scalable, and measurable assurance paradigm for generative AI systems.
